How we handle your data

When you join the waitlist

We store your email address, when you signed up, which list you joined, and how you found us: the referral channel and any campaign tags on the link that first brought you here. That's the whole record. It lives in our waitlist database and is used for exactly one thing: sending you your access when it's ready.

Analytics

We measure the page with events that don't identify you: page views, section views, button clicks. Our analytics service runs in its cookie-free mode and sets no cookies. Events carry a random session identifier and a random id that changes daily, your referral channel, the page variant you saw, and what any web visit carries: the page address with its campaign tags, the page you came from, your browser, operating system and device type, screen and window size, language and time zone. Your email is never attached to an analytics event; our event schema forbids it. We set a few small values in your browser's local storage to make this work (a session id, your referral channel, campaign tags, and the page variant). If you pick a light, dark or blackout theme from the footer, your choice is kept there too, so the next page opens in it. No advertising cookies, no cross-site tracking.

When you have an account

Decks you upload are used only to give you the service: producing your workup, and letting Angel find and quote the relevant pages when you ask about that deal. They aren't sold or used to train anything, not by us and not by the AI providers named under 'The companies that help us run this' below, and they go to no one beyond the companies named there. Decks, workups and everything else in your workspace stay there until you delete them. A workspace owner can delete the whole workspace from Settings, which removes its records and stored files; a retention schedule you set yourself is not available yet, and we delete sooner on request. Resend and Postmark, which carry our email, keep copies of it, and of decks forwarded in it, for up to 45 days. Neon, which holds our database, keeps a 6-hour history so we can undo an accident, so a deleted record can linger there for up to 6 hours. To keep the free workup to one per person, we keep a one-way fingerprint of your email address for two years from the day you sign up, even after you delete your account; only our own systems can match it, and we use it only to recognise that address if it signs up again. If an account's email address is never confirmed, we delete the account 7 days after the last confirmation email we sent, along with the fingerprint it created. Before your free workup starts, we ask you to add a card on Stripe's own page, and it is not charged. To keep the free workup to one per card, we keep a one-way fingerprint of the card, never its number, for two years, even after you delete your account; only our own systems can match it. Wallets like Apple Pay can't be used for this step. We also keep a record of each time you start adding a card, when and with what result, never the card itself, as proof of your agreement, for two years. The wire-instruction check evaluates only the details you enter and the counterparty record you keep. It does not connect to your bank, and it cannot see, monitor, hold, stop, or move funds in any account. Two things are kept so the check can work: the counterparty details you save, and a record of each check you run. That record holds the account details compared, the ones you saved and the ones found in the instructions you pasted, but not the instruction text itself, which is discarded once the comparison runs. Saved counterparty details are deleted automatically once a year passes without a check against them, while the record of each check stays until the workspace is deleted. Deleting the workspace removes both; to remove them sooner, ask us.

Chats with Angel belong to the workspace: everyone in it can read them, and anyone but a viewer can delete them. They are kept until deleted, or until the deal or workspace they belong to is deleted, even after the person who started one leaves. To keep Angel's message limits, we also keep a record of when each question was asked and from which account, without the question itself; it goes when the workspace is deleted. To keep our usage limits, when you delete a deal or a review we keep a short record of each run it made (its kind, when it started, whether it finished and which workspace ran it, but nothing from the deck or the analysis) and delete it within 40 days. If you connect an email account, we hold connected email account details, encrypted access credentials, and any email evidence you save to a deal. If you created your account from one of our links, we keep with it the channel and campaign tags of the first tagged link that brought you to the site, and not the pages you viewed. AngelSift's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Support requests

We keep your message, the topic you picked, and your name, address and workspace, so we can reply. A few more things go with it, and the page shows you them before you send: your browser and the page you were on, and, when you write about a workup, that deal's name, whether the workup finished, any error it hit, and which version of our scoring ran it. If you attach a screenshot, we keep the image too. All of it is used for one thing: answering you. When you write to us from the app's support page, the email that tells us carries only a link to the request, never your name, address, topic or message; if saving the request fails, nothing is kept and the page asks you to send it again. Support requests and their screenshots are deleted with the workspace, and two years after they are sent at the latest; the copies our providers keep are gone within 45 days after that. Ask us and we'll delete yours sooner.

The companies that help us run this

Running the product means a few other companies handle your material for us. Each works for us under its own business terms, and uses your material to provide its service to us.

Two AI providers handle your material. OpenAI reads each page of your deck, indexes it so Angel can find the relevant parts later, and answers the questions you ask Angel. Anthropic produces the analysis. To produce it, Anthropic searches the public web for the company and for the names your deck prints: its people, products, competitors, and the customers and investors it names. When your deck names no founders or leaders, Anthropic first reads the company's own website for them, then searches those names as well. A search holds those names and a short line about what the company sells, taken from your deck's first pages when you haven't typed one; never the rest of your deck. We keep the text of the web pages our research gathers with the deal, as its evidence, and delete it when the deal or its workspace is deleted. From sites that collect and sell information about people, we keep only each page's title and link, not its text. If you connect an email account, Anthropic reads the emails a search for a deal turns up, to judge whether they are evidence, and reads the ones kept when it writes your workup. OpenAI indexes the ones kept, and reads matching emails when you ask Angel about a deal; we don't save what it reads. Neither trains its models on what you send: both providers' business terms, which we have accepted, forbid them from doing so. Both delete what they receive within 30 days, except where they must keep it longer to look into suspected abuse.

When your deck prints patent numbers, our server looks each one up in the US Patent and Trademark Office's public records. That lookup sends the number and nothing else.

The rest is infrastructure. Vercel hosts the site and the app and stores your uploaded files. Neon holds the database with your account and analysis records. Postmark sends our email, and Resend receives decks you forward in. Airtable holds the waitlist and the requests you send from the app's support page. PostHog records the page events described above, which don't identify you. When you have an account, the app also tells PostHog when you sign up, finish your free analysis, start a checkout and pay, under an account number, never your name, email or anything from your decks. It also tells PostHog when a research brief the app writes about a deal quotes an expert in words we cannot find on any of its source pages, so we can review that brief. That note carries the same account number and how many such quotes there were, never the quote, the expert's name or anything from your decks. It also tells PostHog when you download a memo and in which format, under the same account number, never the memo or anything from your decks. When something in the app breaks, PostHog also receives an error report saying what failed and where, under an account number at most, after we strip quoted text and email addresses from it. We run AngelSift from Slack and Linear, so they receive a short note when you sign up, finish your free workup, pay or miss a payment, cancel, reach a usage limit, contact support or hit an error, under an account number, never your name, email or anything from your decks. The one exception: if a payment reaches us after you have deleted your workspace, the note asking us to refund it includes the email the payment was made with.

Stripe handles payments. You enter your card on Stripe's own page, and your card number never reaches us. Stripe keeps your card with your email address and billing address. That includes the card you add before your free workup, which is saved without a payment. What we keep is Stripe's reference for your account, which plan you are on, whether it is paid up, and when the current billing period ends. When you delete your workspace, we remove the card you added for your free workup from Stripe.

Who at AngelSift can see it

No one at AngelSift opens your deck or your workup as a matter of course. We look only when you ask us for help with something, when we have to fix a fault that is affecting your account, or where we have to investigate misuse of the service. When we do, we look at as little as the problem requires.

How we protect it

Everything between your browser and AngelSift travels over an encrypted connection, and a plain address is redirected to the encrypted one. Your password is stored only in a scrambled form that cannot be turned back into your password. Uploaded decks and saved files sit in private storage that only the app can read; there are no public links to them. The credentials for a connected email account are encrypted before they are saved. The bank details you save for the wire check are encrypted before they are stored, and so is the copy kept with each check's record. Inside a workspace, access goes by role: an owner or admin can change settings and billing, a member can work on deals and run analyses, and a viewer can only read. Payment cards are handled by Stripe and never touch our systems. We have not been through an outside security audit. If you need to know more before a decision, ask and we will say exactly where we stand.

What we don't do

We don't sell your data. We don't run your email through marketing lists. Beyond the companies named above, each working for us under its own business terms, we don't share what you give us with anyone. Your email signs you in, marks the decks you forward from it as yours, goes to Stripe when you add a card or pay, and is used to reach you about your access or your account. It is used for nothing else.

Logs, Do Not Track and changes

Our hosting provider keeps server logs of each request, including the IP address it came from, to keep the service secure and running. When you sign in, we keep the IP address and browser of that session with your account. Our analytics service does not store IP addresses. Browsers' Do Not Track setting has no agreed meaning, so we don't treat it differently, and nothing here tracks you across other sites. When this page changes, the date on it changes too. Before a material change takes effect, meaning a new company receiving your information, a new use for it, or keeping it longer, we email you. We ask you first before we use information we already hold in a new way.

Removal

Reply to any email from us, or write to info@angelsift.com, and ask, and we'll delete your record. Waitlist records don't need the ask: once the email we owe you is sent, we delete them on our own.

Accessibility

We build this site to WCAG 2.1 AA, the common standard for accessible websites. Before each release every page is run through an automated accessibility scanner, and checked at phone, tablet and desktop widths for text running off the screen and for the size of the things you tap. The site works without a mouse and keeps a visible focus ring, and it honors your system's reduced-motion setting. Automated checks miss things a person finds. If anything here is hard to use with a screen reader, a keyboard or magnification, write to info@angelsift.com and we will fix it or give you the information another way.